Skip to main content

🛡️ AWS VPC Network ACL is unused🟢

Logic​

Similar Policies​

Description​

Open File

Description​

Ensure that all non-default AWS VPC Network ACLs are actively associated with at least one subnet. Unused NACLs should be identified and removed to maintain a secure and well-managed network environment.

Rationale​

Network ACLs that are not associated with any subnets are considered unused. While unused NACLs do not incur direct costs, they present a potential security risk. If such a NACL contains overly permissive or misconfigured rules and is later associated with a subnet, it could unintentionally expose resources to unauthorized traffic. Regularly identifying and removing unused NACLs reduces the potential attack surface and streamlines network management.

Impact​

Removing unused NACLs has no operational impact on existing resources. However, it strengthens the overall security posture and simplifies audits by eliminating unnecessary configurations.

Audit​

This policy flags an AWS VPC Network ACL as INCOMPLIANT if it has no related AWS VPC Network ACL Associations.

Remediation​

Open File

Remediation​

From Command Line​

Delete Unused NACLs​
aws ec2 delete-network-acl \
    --network-acl-id {{network-acl-id}}

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.16] Unused Network Access Control Lists should be removed1no data
💼 Cloudaware Framework → 💼 System Configuration35no data
💼 FedRAMP High Security Controls → 💼 CM-8(1) Updates During Installation and Removal (M)(H)2no data
💼 FedRAMP Moderate Security Controls → 💼 CM-8(1) Updates During Installation and Removal (M)(H)2no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-8(1) System Component Inventory _ Updates During Installation and Removal2no data
💼 PCI DSS v3.2.1 → 💼 1.1.7 Requirement to review firewall and router rule sets at least every six months.9no data
💼 PCI DSS v4.0.1 → 💼 1.2.7 Configurations of NSCs are reviewed at least once every six months to confirm they are relevant and effective.9no data
💼 PCI DSS v4.0 → 💼 1.2.7 Configurations of NSCs are reviewed at least once every six months to confirm they are relevant and effective.9no data